What is Ingress and how does it route external traffic to Services?

Question

IT Interview Practice · Accepted Answer

An **Ingress** is a Kubernetes object that defines **HTTP/HTTPS routing rules** — mapping hostnames and URL paths to backend **Services**. It is fulfilled by an **Ingress Controller** (nginx, Traefik, cloud gateways) and gives you one entry point, TLS termination, and host/path routing instead of a LoadBalancer per service.

## The problem Ingress solves

```text
Exposing many services with type: LoadBalancer means MANY cloud LBs (and public IPs)
— expensive, and no shared hostname/path routing or TLS.
Ingress gives ONE entry point that routes by host & path to internal ClusterIP Services.
```

## How it fits together

```text
      Internet
         │
   ┌─────┴──────────────┐
   │ Ingress Controller │  (a Pod, e.g. nginx; usually behind ONE LoadBalancer)
   │  reads Ingress rules│
   └─────┬──────────────┘
         │ routes by host / path
   ┌─────┼───────────────┬───────────────┐
   ▼                     ▼               ▼
 Service: web        Service: api    Service: admin  (all ClusterIP)
   │                     │               │
 Pods                  Pods            Pods

Ingress (rules)  ≠  Ingress Controller (the running proxy that enforces them)
```

## An Ingress manifest

```yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: app-ingress
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
spec:
  ingressClassName: nginx
  tls:
    - hosts: [shop.example.com]
      secretName: shop-tls        # TLS cert/key stored in a Secret
  rules:
    - host: shop.example.com
      http:
        paths:
          - path: /api
            pathType: Prefix
            backend:
              service:
                name: api
                port: { number: 80 }
          - path: /
            pathType: Prefix
            backend:
              service:
                name: web
                port: { number: 80 }
```

```text
shop.example.com/api/... → Service "api" → api Pods
shop.example.com/...     → Service "web" → web Pods
TLS is terminated at the controller using the cert in the "shop-tls" Secret.
```

## Key points

```text
• You MUST run an Ingress Controller — the Ingress object alone does nothing.
• ingressClassName selects which controller handles the rules.
• Ingress is HTTP/HTTPS (L7) only. For raw TCP/UDP use a Service or Gateway API.
• The newer Gateway API is the evolving successor with richer, role-oriented routing.
```

```bash
kubectl get ingress                  # list rules, hosts, addresses
kubectl describe ingress app-ingress # see backends & events
```

## Why it matters

Ingress is the standard way to expose HTTP/HTTPS applications to the outside world on Kubernetes, so understanding it is essential networking knowledge for middle-level engineers. The problem it solves is concrete and common: exposing many services via `type: LoadBalancer` means provisioning a separate cloud load balancer and public IP per service — expensive and without shared hostname routing or TLS — whereas an **Ingress** gives you a single entry point that routes by **host and path** to internal ClusterIP Services and terminates **TLS** centrally. The distinction that trips people up is between the **Ingress object** (declarative routing rules) and the **Ingress Controller** (the actual running proxy — nginx, Traefik, a cloud gateway — that watches those rules and enforces them); the rules do nothing without a controller installed, and `ingressClassName` selects which controller handles them. Understanding that Ingress operates at **L7 (HTTP/HTTPS only)** — so raw TCP/UDP needs a Service or the newer Gateway API — and that the **Gateway API** is the evolving, more expressive successor, reflects current, real-world knowledge. Because nearly every user-facing application on Kubernetes needs host/path-based routing and TLS from a single entry point, and because the object-vs-controller distinction is a frequent source of confusion in both interviews and practice, a solid grasp of Ingress is fundamental to exposing and operating web workloads on a cluster.

The problem Ingress solves

How it fits together

An Ingress manifest

Key points

Why it matters

Related questions